Advisory Catalog

Information leakage in YAQL

Improper Privilege Management in djangorestframework-simplejwt

Regular expression denial-of-service in Django

fgr Vulnerable to Insecure Default Variable Initialization

greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file.

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file.

vantage6 vulnerable to a username timing attack on recover password/MFA token

vantage6's CORS settings overly permissive

Apache Airflow: Ignored Airflow Permission

Potential log injection in reset user endpoint in CKAN

aiosmtpd vulnerable to SMTP smuggling

Remote Code Execution Vulnerability in Microsoft Django Backend for SQL Server

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

LibOSDP RMAC revert to the beginning of the session

LibOSDP vulnerable to a null pointer deref in osdp_reply_name

Django MarkdownX Cross-Site Scripting (XSS) vulnerability

pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user

PaddlePaddle Path Traversal vulnerability

PaddlePaddle vulnerable to remote code execution

PaddlePaddle command injection in paddle.utils.download._wget_download

PaddlePaddle command injection vulnerability

JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

RPyC's missing security check results in code execution when using numpy.array on the server-side.

esphome vulnerable to stored Cross-site Scripting in edit configuration file API

Phone information disclosure vulnerability

eth-abi is vulnerable to recursive DoS

LangChain directory traversal vulnerability

A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It

Apache Airflow: Incorrect Default Permissions in audit logs for Ops and Viewers users

Docassemble HTML and javascript injection

Docassemble open redirect

Docassemble unauthorized access through URL manipulation

Apache Airflow: DAG Code and Import Error Permissions Ignored

Mezzanine allows attackers to bypass access controls via manipulating the Host header

Mezzanine allows attackers to bypass access control mechanisms

Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID

Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)

Apache Superset: Improper authorization validation on dashboards and charts import

Apache Superset: Improper data authorization when creating a new dataset

Apache Superset: Improper validation of SQL statements allows for unauthorized access to data

Apache Superset: Improper Neutralization of custom SQL on embedded context

Apache Superset: Improper error handling on alerts